How to Self-Host a V2Ray Server: A Complete Setup Guide

To self-host a V2Ray server, deploy a Linux VPS, install the V2Ray core binary, configure TLS encryption with a valid certificate, set up WebSocket transport behind Nginx, and manage the service with Systemd.

The fanqiang repository by bannedbook provides battle-tested tutorials and configuration templates for building production-ready V2Ray servers. This guide synthesizes the official server setup documentation, extracting the exact file paths, command sequences, and JSON configurations you need to deploy a secure, obfuscated proxy infrastructure.

---

Prerequisites and Core Components

Before proceeding, ensure you have access to these four infrastructure pieces documented across the repository:

Component	Purpose	Source Location
Linux VPS	Hosts the V2Ray daemon and receives client connections	Any cloud provider (Vultr, BandwagonHOST per v2ss/自建V2ray服务器简明教程.md)
V2Ray core binary	Executes the proxy engine with inbound/outbound protocol support	Official release or v2ray官方一键安装脚本
TLS certificate	Encrypts traffic to mimic standard HTTPS	Let's Encrypt via certbot or self-signed for testing
Nginx reverse proxy	Terminates TLS and forwards WebSocket traffic	Configuration templates in v2ss/server-cfg/

The repository emphasizes TLS + WebSocket + Nginx as the gold standard for traffic obfuscation, documented in v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md.

---

Step 1: Provision and Prepare Your VPS

Select a Linux distribution (Ubuntu 20.04+ or Debian 11+ recommended). The tutorial v2ss/自建V2ray服务器简明教程.md covers VPS acquisition from providers including Vultr and BandwagonHOST.

Once connected via SSH, update packages and install dependencies:

sudo apt update && sudo apt upgrade -y
sudo apt install curl wget nginx certbot python3-certbot-nginx -y

Point a domain's A record to your VPS IP before requesting certificates.

---

Step 2: Install V2Ray Core

The repository references two installation methods. For efficiency, use the official one-click script:

bash <(curl -L https://raw.githubusercontent.com/v2fly/fhs-install-v2ray/master/install-release.sh)

This places binaries at /usr/local/bin/v2ray and /usr/local/bin/v2ctl, with configuration directory /usr/local/etc/v2ray/.

Verify installation:

v2ray --version
v2ctl uuid  # Generate your first client UUID

The Windows client guide in windows/V2RayN.md confirms these binary names match official releases.

---

Step 3: Generate TLS Certificate

For production deployments, obtain a valid certificate from Let's Encrypt:

sudo certbot --nginx -d yourdomain.com

Certificates are written to /etc/letsencrypt/live/yourdomain.com/. For testing only, the TLS tutorial (v2ss/自建V2Ray+TLS翻墙配置方法.md) documents self-signed certificate generation.

---

Step 4: Configure V2Ray Server

Create /usr/local/etc/v2ray/config.json with this structure adapted from v2ss/images/config.json:

{
  "inbounds": [
    {
      "port": 10086,
      "listen": "127.0.0.1",
      "protocol": "vmess",
      "settings": {
        "clients": [
          {
            "id": "e3b0c442-98fc-1c14-9afb-6a2a9b3c2d70",
            "alterId": 0,
            "security": "auto"
          }
        ]
      },
      "streamSettings": {
        "network": "ws",
        "wsSettings": {
          "path": "/bannedbook"
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "settings": {}
    }
  ],
  "routing": {
    "rules": [
      {
        "type": "field",
        "outboundTag": "blocked",
        "domain": ["geosite:category-ads-all"]
      }
    ]
  }
}

Critical configuration notes:

• Replace the example id with output from v2ctl uuid
• listen: 127.0.0.1 binds only to localhost—Nginx handles external exposure
• path: "/bannedbook" must match Nginx location block exactly
• Port 10086 is arbitrary; any unprivileged port works for internal communication

---

Step 5: Configure Nginx Reverse Proxy

Create /etc/nginx/sites-available/v2ray with this configuration derived from the Nginx template in v2ss/server-cfg/route-no-udp.json and accompanying guides:

server {
    listen 443 ssl http2;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location /bannedbook {
        proxy_pass http://127.0.0.1:10086;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/v2ray /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

---

Step 6: Deploy Systemd Service

The repository provides v2ss/server-cfg/xray.service as a reference template. Create /etc/systemd/system/v2ray.service:

[Unit]
Description=V2Ray Service
After=network.target

[Service]
User=nobody
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
NoNewPrivileges=true
ExecStart=/usr/local/bin/v2ray -config /usr/local/etc/v2ray/config.json
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable v2ray.service
sudo systemctl start v2ray.service
sudo systemctl status v2ray.service

Verify operation with journalctl -u v2ray -f.

---

Step 7: Firewall and Security Hardening

Restrict inbound traffic to essential ports:

sudo ufw default deny incoming
sudo ufw allow 22/tcp    # SSH

sudo ufw allow 443/tcp   # V2Ray via Nginx

sudo ufw enable

The v2ss/server-cfg/route-no-udp.json file provides an alternative routing policy that disables UDP entirely for restrictive network environments.

---

Step 8: (Optional) Add CDN Layer

For IP masking, wrap your setup with Cloudflare or compatible CDNs. The tutorial v2ss/V2Ray之TLS+WebSocket+Nginx+CDN配置方法.md documents this enhancement:

1. Set Cloudflare DNS proxy status to "Orange cloud" for your domain
2. Use "Full (strict)" SSL mode
3. Ensure WebSocket support is enabled (default on paid plans; requires configuration on free tier)

CDN deployment hides your origin IP from clients and adds DDoS protection.

---

Client Connection and Testing

Export your server configuration as a VMess URI for clients:

vmess://{base64-encoded-json}

The JSON payload includes:

{
  "v": "2",
  "ps": "my-server",
  "add": "yourdomain.com",
  "port": "443",
  "id": "your-generated-uuid",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "yourdomain.com",
  "path": "/bannedbook",
  "tls": "tls"
}

Repository client guides for verification:

• Windows: windows/V2RayN.md
• macOS: macos/V2RayU.md
• Android: android/V2RayNG.md

Test connectivity by browsing to a geo-restricted site or checking your public IP from the client device.

---

Summary

• V2Ray core handles proxy protocols; install via official script or repository reference
• TLS certificate from Let's Encrypt provides encryption and traffic legitimacy
• WebSocket transport with path parameter enables CDN compatibility
• Nginx termination isolates V2Ray from direct internet exposure
• Systemd service from v2ss/server-cfg/xray.service ensures automatic restart and boot persistence
• Configuration file at /usr/local/etc/v2ray/config.json controls inbound VMess and outbound freedom routing

---

Frequently Asked Questions

What is the minimum VPS specification for self-hosting V2Ray?

A 512 MB RAM instance with 10 GB storage suffices for personal use. The tutorials in v2ss/自建V2ray服务器简明教程.md explicitly confirm successful deployments on entry-level VPS tiers from Vultr and BandwagonHOST.

Can I use V2Ray without a domain name?

Yes, but you sacrifice TLS certificate validity and CDN compatibility. The repository includes self-signed certificate instructions for testing, though production deployments require a registered domain for Let's Encrypt issuance.

Why does my Systemd service fail to start?

Common causes include: incorrect path to config.json, missing CAP_NET_ADMIN capability for binding low ports, or JSON syntax errors. Run v2ray test -config /usr/local/etc/v2ray/config.json before reloading Systemd to validate configuration syntax.

How do I migrate from Shadowsocks to V2Ray on the same server?

V2Ray's inbound configuration supports multiple protocols simultaneously. Add a shadowsocks inbound alongside your vmess inbound in config.json, or run separate instances on different ports. The repository maintains parallel guides for both protocols without conflict.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}